The present invention is directed to security measures in a computer system and, more particularly, to systems and methods that combine security requirements of methods in a calling hierarchy of a thread executing on a computer.
Distributed systems usually contain a number of different computers interconnected by communications networks. Oftentimes, a client-server relationship is established between communicating computers. Typically, a "client" is defined as a process making a call to request resources located or controlled by a "server" process. In this context, the computers executing the requesting process and the server process may also be referred to as a client and server, respectively. However, these roles may change depending on the context of information and particular processing taking place.
One mechanism that facilitates the client-server relationship is the Remote Procedure Call (RPC) where the client invokes a function of the server. The RPC is a mechanism that provides synchronized communication between two processes operating on the same or different computers. The RPC mechanism is usually implemented in two parts: one part on the client side and the other part on the server side.
Security is an issue that always arises when client and server computers communicate. A breach in security can severely hamper the operation of both the client's and server's computers. Thus, organizations that use computer systems are vulnerable to persons who may intentionally or unintentionally cause the computer systems to malfunction or who may steal the organizations' confidential information.
System operators typically address three types of security issues: (1) preventing interception and alteration of messages; (2) controlling access to a server; and (3) authenticating a server by a client. System operators have conventionally addressed these issues in object-oriented programming enviromnents by defining a security class that provides methods for setting communication requirements. One such object-oriented programming environment is Sun Microsystems.TM.Java.TM.object-oriented programming environment described in Jaworski, Java 1.1 Developer's Guide, Sams.net, 1997, which is hereby incorporated by reference.
The security class includes five communication requirements: CONFIDENTIALITY, INTEGRITY, ANONYMITY, AUTHENTICATE_SERVER, and NO_DELEGATION. CONFIDENTIALITY ensures that message contents are private. System operators use encryption techniques to assure that only parties with the proper decryption key can decipher the message. INTEGRITY detects when message contents (both requests and replies) have been altered, and refuses to process altered messages. System operators may accomplish this through the use of checksums, or the like, at both the client and server locations.
ANONYMITY represents the client desiring to remain anonymous. In other words, the client does not want to be authenticated by the server. AUTHENTICATE_SERVER represents the client needing to authenticate the server before invoking a remote method. Through this communication requirement, the client ensures that it is communicating with the correct server. NO_DELEGATION refers to the server not being permitted to delegate under the client's identity in calls that it makes. In other words, the server is not authorized to make calls to other computer systems pretending to be the client.
At the client's location, the security class is represented by a single bit for each communication requirement. By setting the bits corresponding to CONFIDENTIALITY, INTEGRITY, ANONYMITY, AUTHENTICATE_SERVER, and NO_DELEGATION, the client designates that confidentiality will be ensured, that integrity will be ensured, that the client will remain anonymous, that the server will be authenticated, and that delegation will not be permitted, respectively.
Conventionally, a client indicates the security class preferences on a global context or on a per-reference basis. In a conventional RPC system, the client usually has a reference to the server. This "server reference" typically contains network information, such as the network address of the server's host; protocol information, such as to which port on the host should a connection be made; and an object identifier that identifies theserver object that will be the subject of the call. Therefore, "per-reference" means that communication requirements are set on an instance of a server reference and, thus, are used by any calls made with that server reference.
If the client sets communication requirements on a global context during the execution of one method, those communication requirements may be overridden by a later method, either by the later method overwriting the global context or by setting communication requirements on a per-reference basis. Even if the client sets communication requirements on a per-reference basis during execution of one method, those communication requirements may be overridden by a later method, by the later method overwriting the communication requirements on that same server reference.
For example, suppose that a client invokes a first method that in turn invokes a second method, passing to the second method a server reference. Suppose that the second method performs a function X on a remote server using that server reference. Suppose firther that the first method has confidential and integrity communication requirements, and sets those requirements either on a global context or on the server reference prior to passing the reference to the second method. Suppose further that the second method overwrites the communication requirements on the reference passed to it, replacing them with a communication requirement for only authenticating the server. In a conventional system, the communication requirements of the second method override the communication requirements of the first method, so the call to the server will only authenticate the server. As a result, the confidentiality and integrity requested by the first method will not be ensured.
The conventional security class preference designation fails to ensure that the individual communication requirements of the methods included in a calling hierarchy will be followed. Accordingly, it is desirable to improve security requirement designation in communication systems.